Gary Warzala

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

The countdown has started ... less than a month away. CornCon X: The Cyber Games, taking place on October 4-5, 2024 in Davenport, IA. This isn’t just another cybersecurity conference. It’s a unique experience that combines top-tier professional insights with a vibrant community atmosphere. What sets CornCon apart? 🌟 - Diverse Topics & Expert Speakers: With over 65 world-class speakers, CornCon covers a wide range of topics from ransomware and IoT to AI and medical devices. - Hands-On Villages & Training: Engage in interactive sessions and hands-on training that provide practical skills you can apply immediately. - CISO Executive Summit: A dedicated summit for CISOs to discuss the latest trends, challenges, and strategies in cybersecurity leadership. - Kids’ Hacker Camp: A unique feature where the next generation of cybersecurity experts can learn and play. A huge shoutout to John D. Johnson, the visionary founder of CornCon. Don’t miss out on this incredible opportunity to learn, network, and grow. Register now and join us in Davenport for an unforgettable experience! https://corncon.net #Cybersecurity #CornConX #CyberGames #CISO #HackerCamp #CyberCommunity

19

NoVa and nearby privacy pros, register now for TOMORROW's IAPP KnowledgeNet Networking Happy Hour in Tyson's Corner 6-8p, food and drinks sponsored by BigID. Space is limited, let us know if we should count you in. https://lnkd.in/eDaytQz9 IAPP IAPP KnowledgeNet - DC Chapter #Dataprivacy #privacy #privacymatters

6

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

🔐 Breaking Down NIST CSF Subcategory GV.SC-06 🔐 When it comes to cybersecurity, it’s not just about what happens inside your organization—it’s also about who you do business with. That’s where NIST CSF Subcategory GV.SC-06 comes into play. GV.SC-06 emphasizes the importance of performing thorough planning and due diligence to reduce risks before entering into formal relationships with suppliers or other third parties. Why is this important? Imagine partnering with a vendor who has weak security practices. That connection could become a gateway for cyber threats, putting your entire organization at risk. GV.SC-06 helps ensure that before you sign any contracts or agreements, you’ve carefully evaluated the potential risks and taken steps to mitigate them. For those unfamiliar with the NIST Cybersecurity Framework, it’s a set of guidelines designed to help organizations manage and reduce cybersecurity risks. It’s a widely respected tool used across various industries to build strong and resilient security strategies. 🌐 By conducting proper due diligence before partnering with third parties, you’re not just protecting your organization—you’re also building a stronger, more secure business network. #Cybersecurity #NISTCSF #RiskManagement #ThirdPartyRisk #DueDiligence

6

This is an easy one to endorse. The latest draft NIST guidelines on Digital Identity - SP800-63B - remove the need for regular password changes except in cases where there is an indication of compromise. They also recommend significantly longer passwords be used, and for systems with sensitive data a second authentication factor. Bruce Schneier's quick reference to the changes linked here:

12

Freeze your credit! It’s easy to unlock when you need it. When you apply for a credit card or loans, you will just have to ask them which credit bureau they use and open it for 24 hours while they pull your credit file. It’s that easy to unlock when you need it, versus the process of getting a fraudulent account off of your credit. https://lnkd.in/gN8QfE6i

2

Most Organizations Not Prepared For Upcoming CISA Software Compliance Deadline A recent survey has revealed a concerning trend: a staggering 80% of organizations are not ready to meet the CISA's Secure Software Development Attestation Form deadline on June 11, 2024. This form, a critical component of Executive Order 14028, mandates software producers working with the U.S. government to confirm the deployment of key security practices. The implications of non-compliance are severe, ranging from legal and financial penalties to increased susceptibility to cyberattacks and reputational damage. Despite the urgency, 84% of companies have not implemented Software Bills of Materials (SBOMs) into their development process, a requirement made mandatory over three years ago. The survey, conducted at RSA Conference 2024, also highlights a lack of awareness, with 65% of security professionals admitting they have never heard of EO 14028. With software supply chain attacks impacting over 2,700 organizations in the U.S. last year alone, the need for immediate action has never been more critical. #Cybersecurity #CISA #Compliance #SoftwareDevelopment #RiskManagement

7

In the string of reported cyber breaches and changes in reporting requirements, the market still shows there to be a nominal effect on an impacted company's share price. UHG’s fell 6.2% in the 5 days after it disclosed the Change Healthcare breach and per Yahoo Finance, CrowdStrike's share price fell 40% at their lowest point and now sits at 15% below their pre-outage price tag. From a risk view, it seems there's a signal that a one-time event does not carry much weight, material or not....at least not as much as other factors that could have a greater impact on a share price. Begs one to think where security should prioritize efforts at the end of the day. #informationsecurity #innovation #strategy #technology https://lnkd.in/gPNB9rXq

10

Security initiatives often start with a good idea and end with a half-baked solution that is iterated on overtime. IMO it's not because individuals don't care about putting in the effort to have a robust solution, they are just more incentivized and driven to implement the most minimum baseline requirements to say the solution works as intended and move onto the next project. And being honest, there's nothing wrong with that considering how product teams are more heavily incentivized to launch their widgets to market in the same manner. Most companies exist to do business, and businesses exist to make money, which means incentives are given and investments are made where there is value to be gained (ROI). Checking the box during the procurement process is simply a means to an end, no matter how much a customer may demand otherwise. #informationsecurity #innovation #strategy #technology https://lnkd.in/gBWVSA7y

9

1 Comment

This speaks volumes to the importance of having a Board members who are versed in cybersecurity and a correctly constructed Board. Take note, and get ready, there will more callouts.

18

1 Comment

Looking forward to the Cyber Security Summit | cybersecuritysummit.org next week and speaking with my friends at Midwest Reliability Organization Steen Fjalstad, Lee Felter, CISSP, PE, Mark Tiemeier, P.E., MBA. Going to be a great discussion of risk in the electric sector and beyond. Hope to see you there!

46

1 Comment

This is a critical need for us all and one I fear we are once again speaking to without working toward a solution. But let me explain why this matters to me….. I am a college dropout teenage dad. I worked those odd jobs, ending up working in a printing plant for several years. I got lucky and an interest in gaming led to a skill in PC hardware salvage. That skill in PC salvage led to my own business and working IT support in a steel mill in the 90s. Eventually that skill led to much more. My story is any one of tens of millions of people with millions of background variations. My path was a very real path to technology in the 90s when the PC was newer to the corporate world. The method still exists, though the path has shifted to add cyber and artificial intelligence alongside technology. There are hundreds, really millions of people who are where I was, and they are unaware of their potential and where they can go if given the opportunity. Many of these people are limited because from their seat they do not see a path that leads them to success. The gap is further ahead than the suggested putting people together with jobs. https://lnkd.in/ejvFwyvE  The gap is in getting people to realize they have a natural skill and in that there is an educational path forward for those people. This is even more day-today to me as my adult soon to be son-in-law required financial support this past semester. He would love to have an affordable education path into any of these proposed initiatives. Adult education for people regardless of their state of diversity are much less available than we like to pretend. We need to focus on a program that begins with recruitment, training, education, and support that leads to the place education does, “recruiting, hiring, and engagement”. It isn’t that the talent isn’t out there. It is that the path appears impossible and unaffordable for the millions without support. I am more than excited about this excellent and absolutely needed initiative. We still need more. We need the offer of financial support to create that new talent. We need support from start to finish. 

10

I know very few of the passwords I use to access systems/applications for personal and work use. Why is that you ask? Because I use a password manager to generate random strings of mixed-case letters, numbers, and symbols with a length of at least 16 characters. For the few passwords I need to remember I create memorable passphrases by selecting 4-6 unrelated words then mashing them together. For examples of passphrases and other password security tips check out CISA's site at the link below. https://bit.ly/3BG81pb #CybersecurityAwarenessMonth

9

🔐 Cybersecurity and Supply Chain: The Dynamic Duo! NIST CSF GV.SC-09 🔐 Ever think about how your favorite superhero gadgets come together? Behind every great tech product is a supply chain, and keeping that chain secure is just as important as locking down your own organization. That’s where NIST CSF Subcategory GV.SC-09 steps in, making sure supply chain security practices are baked right into your cybersecurity and risk management programs. What does that mean? It’s like making sure your superhero tools (aka tech products and services) are secure from day one—and you don’t just set it and forget it. You’re constantly monitoring how things perform throughout their life cycle, keeping a sharp eye on any weak links or hidden villains. For the newbies, the NIST Cybersecurity Framework is your go-to guide for reducing risks and protecting your organization. GV.SC-09 helps you integrate supply chain security into your big-picture strategy—ensuring that your partners, vendors, and suppliers are as secure as you are. 🌐 In the world of cybersecurity, a strong supply chain equals a stronger defense. So, why not make it a key part of your risk management strategy? Because after all, teamwork makes the dream work! #Cybersecurity #NISTCSF #SupplyChainHeroes #RiskManagement #Teamwork

10

I often get asked about the threat of deepfakes when I speak at events. Here is a great overview of the threats of deepfakes as related to fraud and cybersecurity. https://lnkd.in/e7mqZiT6

44

1 Comment

An added benefit, since the Raspberry PI Debug Probe provides standard UART and CMSIS-DAP interfaces over USB, it can also be used to debug any Arm-based microcontroller that provides an SWD port with 3V3 I/O, or even just as a USB-to-UART cable. It works with OpenOCD and other tools that support CMSIS-DAP. #ARM #raspberrypi #hardwaredebug #debug #hardwarehacking

2